This Red Hat security advisory addresses four vulnerabilities in PostgreSQL, including a high-severity symlink-following flaw in pg_basebackup and pg_rewind allowing OS account hijack (CVE-2026-6475, CVSS 8.8) and a high-severity buffer overflow in libpq enabling a server superuser to overwrite client stack memory (CVE-2026-6477, CVSS 8.8). Affected versions are PostgreSQL 14.x before 14.23, 15.x before 15.18, 16.x before 16.14, 17.x before 17.10, and 18.x before 18.4. The fix requires updating PostgreSQL to the patched versions specified for each major release.
Red Hat Product Errata RHSA-2026:29953 - Security Advisory Issued: 2026-06-25 Updated: 2026-06-25 RHSA-2026:29953 - Security Advisory Overview Updated Packages Synopsis Important: postgresql security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for postgresql is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2477439 - CVE-2026-6475 postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind BZ - 2477442 - CVE-2026-6477 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison BZ - 2477448 - CVE-2026-6473 postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVEs CVE-2026-6473 CVE-2026-6475 CVE-2026-6477 CVE-2026-6478 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM postgresql-13.23-1.el9_2.2.src.rpm SHA-256: 1cb4d61761a90979c6bc3bc57b5642c7e8fba9f9dc3d8e377a61d13ad17afc5e x86_64 postgresql-13.23-1.el9_2.2.x86_64.rpm SHA-256: 262934535e855a8ee3fccfdeafc6552a1951641dcaa57569ca210c393938e75a postgresql-contrib-13.23-1.el9_2.2.x86_64.rpm SHA-256: 5fb32d738739c406dabdf1aec679096857e2b4535fc8ab5bfa3e488d051390ca postgresql-contrib-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 48d81f0317f437c2fba92a3799539360e8fa662e23c7e02a225d98a8b1854592 postgresql-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: f3a7402ccd7dc5bc762f1c237a35074cdfd40f111f636f831a1d760680fae002 postgresql-debugsource-13.23-1.el9_2.2.x86_64.rpm SHA-256: c713dd1173491a480946431483c1fd9dacbe62234d9e09fd9877ba090fc1d478 postgresql-docs-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 89f50c9bccebde72cfe89b75a47ebf7fa26ba6e33a79e7e2e54b96a79ddeb035 postgresql-plperl-13.23-1.el9_2.2.x86_64.rpm SHA-256: 0f14860d8ad064bc685a46d93cc8808900404df1d0f71df5bb37618f635bc4bb postgresql-plperl-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 1bb3f406e3d0b284c2e28b65f1bc28b07c3b447517323ced21acb03928364a9b postgresql-plpython3-13.23-1.el9_2.2.x86_64.rpm SHA-256: 7f843c117c38523023a0cfc9f7191c52c8a1d36ef98df44fbafba106f4e74dc5 postgresql-plpython3-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 8e4b3e8312174bbe58becb6db5d57e2f800e75d9888928283facf9a9253dba10 postgresql-pltcl-13.23-1.el9_2.2.x86_64.rpm SHA-256: d4b99b50e8b6452d467ad30afb9705e94e9b9d9cc07e3f03c2bf645b5cdf983c postgresql-pltcl-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: f6f0460575da6cb820653e0b6e8422f0a593ebf630492d505737e1a478d5fa54 postgresql-private-libs-13.23-1.el9_2.2.x86_64.rpm SHA-256: 942cbdd8033fdf1f261924f4e4f1ae0c856d01c2bf0480f4a84bf0dce92adc9f postgresql-private-libs-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 154ccbe6e5e5e1d3eedb2faa14a38d1cbeaede9824791de5e46f8916332264e5 postgresql-server-13.23-1.el9_2.2.x86_64.rpm SHA-256: 4084e519b117ccf722e1b68e9a8eba7f78c629c553cbe40e86e5bad1bfca0a34 postgresql-server-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 6f569e8e6af7a84cd7ee7f2bbcdcdaf992b4d1bd63e1af2979a9c85e1c157da3 postgresql-server-devel-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: df241d8c6b6656192a30402ab17fd98ae6030116255729591204b9d433fd1d8f postgresql-test-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 38c1ddb41d4f36c5e8dfdb5551dd772d0d5c5f97c16713671c9294457cbd9ae0 postgresql-upgrade-13.23-1.el9_2.2.x86_64.rpm SHA-256: 05d732db8d7b8081be110dccbb4c07addced862a139f7a686d394a2b0d4a177d postgresql-upgrade-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 771bd69976f5957ba646a41ce8990e8e4561d04513561c6e75a14ea89c2d807c postgresql-upgrade-devel-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: c27c42ff57cb344ce41fa47846a02c95abe88f43c83b67e9027550e7445afc47 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM postgresql-13.23-1.el9_2.2.src.rpm SHA-256: 1cb4d61761a90979c6bc3bc57b5642c7e8fba9f9dc3d8e377a61d13ad17afc5e ppc64le postgresql-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 0fd8cd17c95b1946a852059630c101326e47bd474e08daf7bad639e15e3299c8 postgresql-contrib-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 46cb4e8a103ab914a3ad2ff625b15e8931156ccdb028f0390a6e5537c0a73c2e postgresql-contrib-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: e1db7d3063bf5b3a0729d25ade674e1435ca8964f59c4d87661030c7780551bf postgresql-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: a30988afad108fde0d4131f7a16bf21e9cf060ffe7d568dd76a8935ac5236636 postgresql-debugsource-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 403ccad8404033f3c9d2236b6aef0eb90c7be0ea37e6267d4326c469d8423edd postgresql-docs-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 9bd334fac4202e4d618fb0128afe8ebad2405d01ddf54f9cf3247bd5307b9042 postgresql-plperl-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 0fc5d63314a8633c3a357c0fcebe2e602302b6ea286dc6451def6a78c140df87 postgresql-plperl-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 206eb7ee7b578b9862a06f3302825fcc61af0ed919c143958433042674e20ac1 postgresql-plpython3-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 3182f163bcb1f759a73834a208516975e813b02ccc798e1f59b92778ad9a6e48 postgresql-plpython3-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: f54dc5546e418b7f8115d445528118a5f10d35d3b410a7bd20aeb3ccd92407eb postgresql-pltcl-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 27588968bc4c811fb3d4d8d0f11d772a96b48c841f8fc6ae745d5dc4e7f44eaa postgresql-pltcl-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: f2b5c14c1bfce302ad0409d9bfbba6126f0e8f14854121205d651be97eaffd19 postgresql-private-libs-13.23-1.el9_2.2.ppc64le.rpm SHA-256: d36c32019787e960e07650a3618390d767021aec35ba29ff36e17a4fc0a557bf postgresql-private-libs-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 2047215f675144d320f093cf210a6ffb8e13f2bf7268f75007b6de470a5ff5cc postgresql-server-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 38860a197b4dfda195563973bf0e244cccb0fd05dcf265ad45a362e8f5708314 postgresql-server-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 59010a2d44a1a9efad7f9567536cbe92b55c0d3136783aa7c691b33b6c067acc postgresql-server-devel-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: e1c40d2aac0096b87f7e24afd498b18f0c22bd4dd6e8db4d5322dcfdc83c1085 postgresql-test-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: d7cd1f059f3c95f6f3c3cfe6c6be9e82d8ae1ad0da00db11ec33835c59c20782 postgresql-upgrade-13.23-1.el9_2.2.ppc64le.rpm SHA-256: a9b5c5f0942e38d87c9dfeee836a5407387063c86fc809ff64378b0ce13b7b21 postgresql-upgrade-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 1f8f695682eb168adb31ebe3b67b984eb23965142c4c3ac35d8a599d086a1cbc postgresql-upgrade-devel-debuginfo-13.23-1.el9_2.2.ppc64le.rpm SHA-256: 5429e084884b4ab7d72821c517f7c348070d92de9ecf079a9bec3b6602a473d6 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM postgresql-13.23-1.el9_2.2.src.rpm SHA-256: 1cb4d61761a90979c6bc3bc57b5642c7e8fba9f9dc3d8e377a61d13ad17afc5e x86_64 postgresql-13.23-1.el9_2.2.x86_64.rpm SHA-256: 262934535e855a8ee3fccfdeafc6552a1951641dcaa57569ca210c393938e75a postgresql-contrib-13.23-1.el9_2.2.x86_64.rpm SHA-256: 5fb32d738739c406dabdf1aec679096857e2b4535fc8ab5bfa3e488d051390ca postgresql-contrib-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 48d81f0317f437c2fba92a3799539360e8fa662e23c7e02a225d98a8b1854592 postgresql-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: f3a7402ccd7dc5bc762f1c237a35074cdfd40f111f636f831a1d760680fae002 postgresql-debugsource-13.23-1.el9_2.2.x86_64.rpm SHA-256: c713dd1173491a480946431483c1fd9dacbe62234d9e09fd9877ba090fc1d478 postgresql-docs-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 89f50c9bccebde72cfe89b75a47ebf7fa26ba6e33a79e7e2e54b96a79ddeb035 postgresql-plperl-13.23-1.el9_2.2.x86_64.rpm SHA-256: 0f14860d8ad064bc685a46d93cc8808900404df1d0f71df5bb37618f635bc4bb postgresql-plperl-debuginfo-13.23-1.el9_2.2.x86_64.rpm SHA-256: 1bb3f406e3d0b284c2e28b65f1bc28b07c3b447517323ced21acb03928364a9b postgresql-plpython3-13.23-1.el9_2